runward gate
Version updated for https://github.com/stranxik/runward to version v0.33.5.
- This action is used across all versions by 0 repositories.
Action Type
This is a Composite action.
Go to the GitHub Marketplace to find the latest changes.
Action Summary
Runward automates the verification of engineering decisions behind AI-generated code, ensuring that critical aspects of software delivery are adhered to. It provides a deterministic gate to check that the process was followed, making it easier to verify compliance with standards like ISO 42001 and NIST AI RMF.
What’s Changed
No verdict changes. The canary for ADR-0049: the first release whose provenance is signed by the isolated builder.
The tarball is built, tested and its provenance signed inside build-and-attest.yml, a reusable workflow whose steps release.yml cannot reach into; the signing certificate names that file. The publish job packs the same commit itself and refuses to publish a builder tarball that does not byte-match. npm publish stays under OIDC trusted publishing, unchanged.
What this release must establish, written before the tag:
gh attestation verify runward-0.33.5.tgz --repo stranxik/runward \
--signer-workflow stranxik/runward/.github/workflows/build-and-attest.yml
passing on the published artifact; the determinism cross-check holding; a local rebuild of the attested commit reconciling byte for byte. verify-release.yml requires the signer identity on this run — the outcome is loud in both directions.
No SLSA level is asserted anywhere. Verification procedure: docs/verifying-a-release.md.
Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md